3 ms·

Apps A and B could just keep a list of expired cookies and the IdP could add to that list using a server-to-server call.

• bandie91 6y ago
  the main idea of SAML is not to do direct server-to-server communication.
• kevincox 6y ago
  This is how it should work. But I don't think any popular system implements this.